[SECURITY] [DSA 1405-2] New zope-cmfplone packages fix regression

-----BEGIN PGP SIGNED MESSAGE-----

Hash: SHA1

• -------------------------------------------------------------------------- Debian Security Advisory DSA 1405-2 security@debian.org http://www.debian.org/security/ Thijs Kinkhorst November 11th, 2007 http://www.debian.org/security/faq
• --------------------------------------------------------------------------

Package        : zope-cmfplone
Vulnerability  : missing input sanitising
Problem-Type   : remote
Debian-specific: no
CVE ID         : CVE-2007-5741
Debian Bug     : 449523

The zope-cmfplone update in DSA 1405 introduced a regression. This update corrects this flaw. For completeness, the original advisory text below:

It was discovered that Plone, a web content management system, allows remote attackers to execute arbitrary code via specially crafted web browser cookies.

The oldstable distribution (sarge) is not affected by this problem.

For the stable distribution (etch) this problem has been fixed in version 2.5.1-4etch2.

For the unstable distribution (sid) this problem will be fixed soon.

We recommend that you upgrade your zope-cmfplone package.

Upgrade Instructions

- --------------------

wget url
        will fetch the file for you
dpkg -i file.deb
        will install the referenced file.

Do you need help?

In addition to our free technical library, Pantek provides professional IT services to companies who utilize Open Source software: Learn more about Pantek's Technical Support offerings Place an order for 24/7/365 Technical Support here Learn more about Pantek, who we are, and what we do Chat with a Live Operator Related lists.debian.org Links debian-announce debian-apache debian-arm-changes debian-beowulf debian-boot debian-cd debian-cd-vendors debian-changes debian-changes-digest debian-isp debian-kde debian-laptop debian-mirrors-announce debian-news debian-security debian-security-announce debian-testing debian-user debian-user-digest Request more information about Pantek

If you are using the apt-get package manager, use the line for sources.list as given below:

apt-get update

        will update the internal database apt-get upgrade

        will install corrected packages

You may use an automated update by adding the resources from the footer to the proper configuration.

Debian GNU/Linux 4.0 alias etch

- -------------------------------

  Source archives:

    
http://security.debian.org/pool/updates/main/z/zope-cmfplone/zope-cmfplone_2.5.1-4etch2.dsc
      Size/MD5 checksum:     1114 c4e8894601f85060c50ba1eb0823097d
    
http://security.debian.org/pool/updates/main/z/zope-cmfplone/zope-cmfplone_2.5.1-4etch2.diff.gz
      Size/MD5 checksum:    11213 fdecf98503f9593ebfea4f286608740e
    
http://security.debian.org/pool/updates/main/z/zope-cmfplone/zope-cmfplone_2.5.1.orig.tar.gz
      Size/MD5 checksum:  1064993 b48215d46aafa9e1f12196263d86a191

  Architecture independent components:

    
http://security.debian.org/pool/updates/main/z/zope-cmfplone/plone-site_2.5.1-4etch2_all.deb
      Size/MD5 checksum:     9900 d8e5a2a383e6dda0e280a71d050b1338
    
http://security.debian.org/pool/updates/main/z/zope-cmfplone/zope-cmfplone_2.5.1-4etch2_all.deb
      Size/MD5 checksum:  1190836 1dae183bffb2bdd44e304cb457edd234

Do you need more help?

In addition to our free technical library, Pantek provides professional IT services to companies who utilize Open Source software: Learn more about Pantek's Technical Support offerings Place an order for 24/7/365 Technical Support here Learn more about Pantek, who we are, and what we do Chat with a Live Operator Related lists.debian.org Links debian-announce debian-apache debian-arm-changes debian-beowulf debian-boot debian-cd debian-cd-vendors debian-changes debian-changes-digest debian-isp debian-kde debian-laptop debian-mirrors-announce debian-news debian-security debian-security-announce debian-testing debian-user debian-user-digest Request more information about Pantek

  These files will probably be moved into the stable distribution on   its next update.

• --------------------------------------------------------------------------------- For apt-get: deb http://security.debian.org/ stable/updates main For dpkg-ftp: ftp://security.debian.org/debian-security dists/stable/updates/main Mailing list: debian-security-announce@lists.debian.org Package info: `apt-cache show <pkg>' and http://packages.debian.org/<pkg>
  -----BEGIN PGP SIGNATURE-----
  Version: GnuPG v1.4.6 (GNU/Linux)

iD8DBQFHNzD2Xm3vHE4uyloRAhoBAJ44YToEKkvSF7mn0YD+ygklkwiaaQCfVjqx otvngW9TchYPo9aJwsWdai8=
=hBR8
-----END PGP SIGNATURE-----

-- 
To UNSUBSCRIBE, email to debian-security-announce-REQUEST@lists.debian.org
with a subject of "unsubscribe". Trouble? Contact listmaster@lists.debian.org